Data Processing Agreement

Parties and scope

The Controller is the company that opens a Teklif Atölyesi account and enters personal data of its customers, suppliers and employees into the app. The Processor is Teklif Atölyesi, which processes this data solely to provide the service and on the Controller's instructions.

Data that Teklif Atölyesi processes for its own purposes (account holders' sign-in data, billing, support correspondence) is covered by the privacy policy, not by this agreement; for that data Teklif Atölyesi is the controller.

Subject matter, nature and duration

• Subject matter: running quoting, order, production, shipping, payment collection and customer communication processes, including the customer portal, notifications and document generation.
• Nature: recording, storage, editing, viewing, transmission (through the channels the company chooses: email, WhatsApp, SMS), backup and deletion.
• Duration: for the term of the subscription; on account closure as set out under "End of the agreement" below.

Categories of personal data and data subjects

• Data subjects: the Controller's customers and their contact persons, suppliers, employees and app users.
• Data categories: identity (name, title), contact (phone, email, address), customer transactions (quotes, orders, payments, account statements), tax (tax office and number), uploaded files and message contents, transaction security (IP address, approval records).
• Processing of special categories of personal data (health, biometric data, etc.) is not intended; the Controller should not enter such data into the app.

Controller's instructions

The Processor processes personal data only on the Controller's documented instructions. Settings in the app and actions taken by the Controller's users (for example sending a quote or connecting an integration) count as instructions. If the Processor considers an instruction to infringe the law, it informs the Controller without delay.

The Processor does not use the data for its own purposes, does not sell it, does not process it for advertising and does not combine it with other companies' data.

Confidentiality

Employees and contractors with access to the data are bound by written confidentiality obligations; access is limited to the people and the extent needed for support, maintenance and security.

Security measures (KVKK Art. 12)

• Tenant isolation: every query is filtered by company; no company can access another company's records.
• Encryption in transit (TLS), password hashing with Argon2 and encrypted storage of integration keys.
• Role and permission matrix, server-side hiding of cost and margin data from unauthorised users, two-step sign-in and re-authentication for sensitive actions.
• Audit logs for critical actions; daily encrypted backups and regular restore drills.
• Regular security updates and monitoring of access logs.

Sub-processors

The Controller gives general authorisation for the use of the service providers listed on the Sub-processors page. The Processor enters into agreements with sub-processors containing obligations no less protective than those in this agreement and remains liable to the Controller for their processing.

The Controller is notified by email and in the app at least 30 days before a new sub-processor is added or an existing one is replaced. The Controller may object on reasonable grounds; if no agreement is reached, it may end the subscription without extra charge.

Services the company connects itself (its own AI key, WhatsApp Business account, e-invoicing provider, payment account, email server) are governed by the Controller's own agreements; data is sent to these services on the Controller's instructions.

International transfers

Data is stored on servers in Germany (EU). Transfers abroad are made with the appropriate safeguards required by KVKK Art. 9 (standard contracts published by the Board and the required notifications) and with the GDPR standard contractual clauses. Which service processes data in which country is listed on the Sub-processors page.

Data subject requests

The Processor reasonably assists the Controller in responding to requests under KVKK Art. 11 and GDPR Art. 15–22: tools for correcting, exporting (JSON/CSV) and deleting records are available in the app. Requests received directly by the Processor are forwarded to the Controller without delay.

Personal data breach notification

The Processor notifies the Controller without undue delay and at the latest within 48 hours after becoming aware of a breach affecting the Controller's data; the notice describes the nature of the breach, the categories of data and data subjects affected, the likely consequences and the measures taken. It assists the Controller in meeting its obligations to notify the Board and the data subjects.

Audits and information

The Processor provides the Controller with the information needed to demonstrate compliance with this agreement. It contributes to audits carried out with reasonable prior notice, at most once a year and under confidentiality; the costs of the audit are borne by the Controller. Audits by the Board or competent authorities are not subject to this limit.

End of the agreement

When the subscription ends or the account is closed, the Controller can export its data from the app. After account closure, data is deleted or anonymised within 30 days at the latest; it may remain in backups for up to 30 more days. Records subject to statutory retention (such as invoices) are kept for the required period.

Liability, entry into force and changes

The terms of use govern limitations of liability and the applicable law. This agreement enters into force upon acceptance and remains valid for the term of the subscription. When the agreement changes, its version number is updated and the company owner is asked to accept it again in the app. Version of this text: 2026-10-01.